Bug: Dead/broken RPC endpoints in Solana and EVM fallback lists

Brouie commented

2026-04-13 06:33:51 +00:00

(Migrated from gitlab.com)

Several RPC endpoints in the frontend fallback lists are broken, slowing down fallback and spamming the console:

Solana:

api.blockeden.xyz -- 429 Too Many Requests
api.mainnet-beta.solana.com -- 403 Forbidden (still in list)

EVM (opBNB):

eth.merkle.io -- CORS rejected from bridge.cl8y.com origin, spams console nonstop
public-bsc-mainnet.fastnode.io -- CORS rejected
binance.llamarpc.com -- ERR_NAME_NOT_RESOLVED (domain dead)

These should be removed or replaced. The merkle.io spam on opBNB transfers is particularly bad (18+ errors in console per transfer).

Observed on build 0a78fe7 (main-CHZ1ahQz) during Phantom wallet testing 4/13.

Several RPC endpoints in the frontend fallback lists are broken, slowing down fallback and spamming the console: **Solana:** - api.blockeden.xyz -- 429 Too Many Requests - api.mainnet-beta.solana.com -- 403 Forbidden (still in list) **EVM (opBNB):** - eth.merkle.io -- CORS rejected from bridge.cl8y.com origin, spams console nonstop - public-bsc-mainnet.fastnode.io -- CORS rejected - binance.llamarpc.com -- ERR_NAME_NOT_RESOLVED (domain dead) These should be removed or replaced. The merkle.io spam on opBNB transfers is particularly bad (18+ errors in console per transfer). Observed on build 0a78fe7 (main-CHZ1ahQz) during Phantom wallet testing 4/13.

Brouie commented

2026-04-21 05:20:06 +00:00

(Migrated from gitlab.com)

mentioned in issue #111

Brouie commented

2026-04-21 05:21:56 +00:00

(Migrated from gitlab.com)

@PlasticDigits follow-up finding from #111 Terra post-upgrade fallback RPC audit (4/21):

lcd.terra-classic.hexxagon.dev is listed as a columbus-5 fallback in packages/multichain-rs/src/terra/client.rs but currently returns chain_id: rebel-2 (testnet), latest block 30,366,128.

Other fallbacks healthy on columbus-5:

terra-classic-lcd.publicnode.com — primary, columbus-5, height 28,264,695+
lcd.terra-classic.hexxagon.io — columbus-5, height 28,264,706+
terra-classic-fcd.publicnode.com — columbus-5, height 28,264,706+

Risk: if operator/canceler fails over to .dev during degradation, it queries the wrong chain entirely (different state, different heights, different tx index). Not dead — just wrong network. Either hexxagon repointed .dev to testnet, or it was mislabeled at commit time.

Suggested fix: remove hexxagon.dev from mainnet columbus-5 fallback list in terra/client.rs, or confirm with hexxagon that a mainnet URL exists.

@PlasticDigits follow-up finding from #111 Terra post-upgrade fallback RPC audit (4/21): `lcd.terra-classic.hexxagon.dev` is listed as a `columbus-5` fallback in `packages/multichain-rs/src/terra/client.rs` but currently returns `chain_id: rebel-2` (testnet), latest block 30,366,128. Other fallbacks healthy on columbus-5: - `terra-classic-lcd.publicnode.com` — primary, columbus-5, height 28,264,695+ - `lcd.terra-classic.hexxagon.io` — columbus-5, height 28,264,706+ - `terra-classic-fcd.publicnode.com` — columbus-5, height 28,264,706+ Risk: if operator/canceler fails over to `.dev` during degradation, it queries the wrong chain entirely (different state, different heights, different tx index). Not dead — just wrong network. Either hexxagon repointed `.dev` to testnet, or it was mislabeled at commit time. Suggested fix: remove hexxagon.dev from mainnet columbus-5 fallback list in `terra/client.rs`, or confirm with hexxagon that a mainnet URL exists.

PlasticDigits commented

2026-04-21 06:14:22 +00:00

(Migrated from gitlab.com)

mentioned in commit f8cffca2e6

mentioned in commit f8cffca2e62cefa54d88f2da1de5828651bce4f3

PlasticDigits commented

2026-04-21 06:31:40 +00:00

(Migrated from gitlab.com)

Shipped a fix on main (f8cffca) aligned with the problems called out here (and the Terra LCD follow-up in the thread). Leaving this issue open until browser/Phantom QA confirms the console is clean.

Frontend / config

Terra (columbus-5): Dropped unstable columbus-lcd.terra.dev from LCD fallbacks; added https://api-lunc-lcd.binodes.com and documented that *.hexxagon.dev is rebel-2, not mainnet. Added Tendermint RPC fallbacks on the bridge row: https://api-lunc-rpc.binodes.com, https://rpc.terra-classic.hexxagon.io.
BSC: Removed binance.llamarpc.com and public-bsc-mainnet.fastnode.io from the embedded fallback list (dead / CORS pain from the web app).
Solana: Default chainlist RPC → https://solana-rpc.publicnode.com/; docs/QA samples updated away from Blockeden / browser-hostile ordering. (Built-in solanaMainnetRpcDefaults was already excluding Blockeden; chainlist now matches that direction.)

Docs

docs/deployment-guide.md §10: public LCD/RPC notes for Terra Classic, BSC browser caveats, Solana browser caveats.
Solana runbook + QA onboarding + mainnet token checklist updated for copy-paste defaults.

Rust

rpc_fallback unit test only: sample comma-list third URL swapped to bsc.drpc.org (no runtime behavior change there).

@Brouie — when you have a moment, can you re-verify on a fresh deploy (or local prod build) with Phantom: Solana reads, opBNB transfer path, and Terra LCD failover, and confirm the console no longer spams 403/CORS/429 from the old endpoints? If anything still misbehaves, note which network tab / URL is failing and we can tighten the list further.

Shipped a fix on **main** ([`f8cffca`](https://gitlab.com/PlasticDigits/cl8y-bridge-monorepo/-/commit/f8cffca)) aligned with the problems called out here (and the Terra LCD follow-up in the thread). Leaving **this issue open** until browser/Phantom QA confirms the console is clean. **Frontend / config** - **Terra (columbus-5):** Dropped unstable `columbus-lcd.terra.dev` from LCD fallbacks; added `https://api-lunc-lcd.binodes.com` and documented that `*.hexxagon.dev` is **rebel-2**, not mainnet. Added Tendermint **RPC** fallbacks on the bridge row: `https://api-lunc-rpc.binodes.com`, `https://rpc.terra-classic.hexxagon.io`. - **BSC:** Removed `binance.llamarpc.com` and `public-bsc-mainnet.fastnode.io` from the embedded fallback list (dead / CORS pain from the web app). - **Solana:** Default chainlist RPC → `https://solana-rpc.publicnode.com/`; docs/QA samples updated away from Blockeden / browser-hostile ordering. (Built-in `solanaMainnetRpcDefaults` was already excluding Blockeden; chainlist now matches that direction.) **Docs** - `docs/deployment-guide.md` §10: public LCD/RPC notes for Terra Classic, BSC browser caveats, Solana browser caveats. - Solana runbook + QA onboarding + mainnet token checklist updated for copy-paste defaults. **Rust** - `rpc_fallback` unit test only: sample comma-list third URL swapped to `bsc.drpc.org` (no runtime behavior change there). @Brouie — when you have a moment, can you **re-verify** on a fresh deploy (or local prod build) with Phantom: Solana reads, opBNB transfer path, and Terra LCD failover, and confirm the console no longer spams 403/CORS/429 from the old endpoints? If anything still misbehaves, note which network tab / URL is failing and we can tighten the list further.

Brouie commented

2026-04-22 00:45:41 +00:00

(Migrated from gitlab.com)

@PlasticDigits verified fix on f8cffca.

Terra Classic fallbacks — 3 new endpoints all on columbus-5 mainnet:

api-lunc-rpc.binodes.com — network: columbus-5 ✅
rpc.terra-classic.hexxagon.io — moved from .dev (which was rebel-2 testnet per 4/21 finding) ✅
api-lunc-lcd.binodes.com — network: columbus-5 ✅
lcd.terra-classic.hexxagon.io — network: columbus-5 ✅

BSC removals:

binance.llamarpc.com — no response on live check, dead confirmed ✅
public-bsc-mainnet.fastnode.io — returns 415 on HEAD, known browser-hostile (CORS), removal justified ✅

Terra RPC fallbacks section added (was missing entirely before).

Every endpoint verified live from QA server. Closing on code-level verification; actual frontend fallback cascade will be exercised naturally as part of regular bridge usage once deployed.

@PlasticDigits verified fix on f8cffca. **Terra Classic fallbacks** — 3 new endpoints all on columbus-5 mainnet: - `api-lunc-rpc.binodes.com` — `network: columbus-5` ✅ - `rpc.terra-classic.hexxagon.io` — moved from `.dev` (which was rebel-2 testnet per 4/21 finding) ✅ - `api-lunc-lcd.binodes.com` — `network: columbus-5` ✅ - `lcd.terra-classic.hexxagon.io` — `network: columbus-5` ✅ **BSC removals:** - `binance.llamarpc.com` — no response on live check, dead confirmed ✅ - `public-bsc-mainnet.fastnode.io` — returns 415 on HEAD, known browser-hostile (CORS), removal justified ✅ **Terra RPC fallbacks section added** (was missing entirely before). Every endpoint verified live from QA server. Closing on code-level verification; actual frontend fallback cascade will be exercised naturally as part of regular bridge usage once deployed.

Brouie (Migrated from gitlab.com) closed this issue

2026-04-22 00:45:42 +00:00

Rows
Columns

Bug: Dead/broken RPC endpoints in Solana and EVM fallback lists #109